CVE-2008-1937
MoinMoin vulnerable to privilege escalation
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
Exploit likelihood
What each source reports
NVD Score used
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
- Record
CVE-2008-1937- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
- Record
CVE-2008-1937- Updated
- 2026-11-02
EUVDEUVD-2008-0005 No score
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
- Record
EUVD-2008-0005- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqxp-6926-hphr
MoinMoin vulnerable to privilege escalation
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
- Record
GHSA-rqxp-6926-hphr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-rqxp-6926-hphr
MoinMoin vulnerable to privilege escalation
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
- Record
GHSA-rqxp-6926-hphr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVPYSEC-2008-12 No score
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
- Record
PYSEC-2008-12- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1937 is a medium vulnerability (CVSS 6.8) in Moinmoin, published April 24, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 76th percentile. Fixed in moin 1.6.3.
References
moinmo.in/SecurityFixes
security.gentoo.org/glsa/glsa-200805-09.xml
exchange.xforce.ibmcloud.com/vulnerabilities/41909
hg.moinmo.in/moin/1.6/rev/f405012e67af
vupen.com/english/advisories/2008/1307/references
secunia.com/advisories/30160
Show 10 moreShow less
securityfocus.com/bid/28869
nvd.nist.gov/vuln/detail/CVE-2008-1937
web.archive.org/web/20080628213526/http://secunia.com/advisories/29894
github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2008-12.yaml